In computing environments, virtual switches may be used that comprise software modules capable of providing a communication platform for one or more virtual nodes in the computing environment. These virtual switches may be used to intelligently direct communication on the network by inspecting packets before passing them to other nodes on the same network. For example, packets may be inspected to determine the source and destination internet protocol (IP) addresses to determine if the communication is permitted to be delivered to the destination computing node. In some implementations, virtual switches may be configured with flow processes that can include one or more flow operations, or tables, that define rules and actions to be taken against a packet. These flow operations identify specific attribute values, such as IP addresses, media access control (MAC) addresses, and the like, within the data packet and, when identified, provide a set of actions to be asserted against the data packet. These actions may include modifications to the data packet, forwarding rules for the data packet, amongst other possible operations.
To manage virtual switches, communication protocols, such as OpenFlow and/or other software defined networking (SDN) protocols, may be used, wherein the protocols enable network controllers to determine the path of network packets across a network of switches. In particular, in some implementations, virtual switches may be distinct from the controllers that supply packet forwarding configurations. These controllers may, using the communication protocol, provide layer 3 remote administration by modifying forwarding tables, and by adding, modifying, and removing packet matching rules and actions. However, limitations exist with the control communication protocol and implementation of rules on received packets. These limitations may prevent new packet rules from being applied to the same packet that triggered the implementation of the packet rule. Thus, a new rule could only be applied to a second packet after the first packet triggered the implementation of the new rule.